Writing Security Tools and Exploits
Learn to read, analyze, modify, and write custom exploits and enhance security tools with little or no assistance with help from this authoritative text.
TABLE OF CONTENTS Writing Security Tools and Exploits
Advanced Dissector Concepts
To write more advanced dissectors, you need to understand how exceptions work in Ethereal. Knowing this will allow you to dissect as much of a packet as possible, even if the packet is corrupt or missing data. Dissectors can also have user preferences that modify their behavior.
Exceptions
As learned in the discussion about tvbuffs, exceptions are present in Ethereal; they can be thrown and caught by the program. But Ethereal is written in American National Standards Institute (ANSI) C, which does not contain native exceptions like C++, Java, or Python. A module from the Kazlib library, an open-source library of useful ANSI C routines, was added to Ethereal. Kazlib can be found at http://users.footprints.net/~kaz/kazlib.html. It provides a cross-platform exception module that works on any platform where ANSI C works, including Windows. The Kazlib source files in the Ethereal distribution are epan/except.c and epan/except.h.
A set of macros located in epan/exceptions.h was developed to make working with exceptions easier. This is the interface that the Ethereal code uses. In that file, the possible exceptions are defined with integers. As of Ethereal 0.10.10, there are only four possible exceptions.
#define BoundsError 1#define ReportedBoundsError 2#define TypeError 3#define DissectorError 4
The first two are the most common. A BoundsError is thrown by the tvbuff routines if a data access...
Copyright Syngress Publishing, Inc. 2006 under license agreement with Books24x7
